Out of Control

Image

CreditBrian Stauffer

By Gregg Easterbrook

March 17, 2014

WASHINGTON — WHEN mass murderers took over the cockpits of four American airliners on Sept. 11, 2001, one of the first things they did was turn off the transponders, so the planes would not register properly on civilian radar.

A few months later, the Council on Foreign Relations published a book, “How Did This Happen?” about the mistakes leading to that awful day. I wrote the aviation security chapter, which highlighted vulnerabilities in the way airliner transponders operate.

If the transponders had not gone silent on 9/11, air traffic controllers would have quickly realized that two jetliners en route to Los Angeles had made dramatic course changes and were bound straight for Manhattan. Instead, controllers lost precious time trying to figure out where the aircraft were.

At the time, I would have bet my life’s savings that the transponder, which broadcasts an aircraft’s location and identity, would be re-engineered to prevent hijackers from turning such units off. But nothing was done. Almost 13 years later, Malaysia Airlines Flight 370 sparked a lengthy worldwide search when, it appears, another transponder was turned off.

The issue today is exactly as it was on 9/11. Pilots like their locations to be known — for ground assistance, and because the transponder warns other nearby planes of their course and altitude. Only a hijacker at the controls of an aircraft would want the transponder silent.

Flight 370 was not unique: Most of the world’s jetliners have transponders that can be turned off. On the 777-200, the type of plane used on the flight, there’s a simple rotary switch near the first officer’s left hand. All someone has to do to turn the transponder off is rotate the dial.

Of course, transponders aren’t the only way to detect a plane: There’s always radar. In the movies, radar screens show incredible detail about everything. In real life, radar is easily confused, doesn’t see small planes, and may have trouble determining altitudes. Transponders solve this by reporting an aircraft’s altitude, speed, directional heading and identification code to air traffic controllers and nearby aircraft, using an electronic format that syncs with radar. And the identification codes tell controllers which blip is which flight, something radar has no way to detect.

Some military radars can provide Hollywood-style detail, but military radar is not usually watching civilian flights, and when it is, it needs the transponder code to know what it’s looking at. One reason it took nearly a week for American intelligence to conclude that Flight 370 had gone far off course is that analysts had to pore over reams of raw data trying to figure out which tracks were from that particular jet.

Why is there a transponder switch in the first place? Until recently, transponders had to be off when a plane was on the ground, to avoid sending signals that disrupted airport radar. The designs for some private aircraft — but not yet the large commercial planes — deal with this by using automated transponders that turn on when the planes become airborne, then turn off when they slow to taxi speed.

Lately, major airports have installed ground-scanning radars that don’t get confused by transponders on taxiways. Large jetliners like the 777 typically operate from such airports, and when they do, they never have a reason to switch the transponder off.

The transponder’s off switch is a vestige of an earlier era, before reliable chip-based electronics. Older model transponders sometimes sent out spurious altitude readings. “Air traffic control would call and tell you to ‘cycle’ the transponder,” meaning switch it off and then back on in a reset sequence, noted Patrick Smith, a veteran pilot and the author of the 2012 book about air travel, “Cockpit Confidential.”

In case cycling does not correct the fault, all jetliners have backup transponders. Flight 370 had a backup transponder — but as with most such units, someone in the cockpit must switch the backup on. No one did that on Flight 370.

The solution is a location-broadcasting system that the flight crew cannot switch off. Over the next few years, much of the world plans to adopt an aviation tracking standard called ADS-B, which should make it harder for a plane to stop reporting its position. Automated transponders should be part of that transition.

Of course, automation of complex systems can have unintended consequences. But most of the flight time of modern jetliners occurs on autopilot — every day, millions of lives worldwide are in the hands of autopilots for extended periods. If automation can be trusted to fly the entire plane, why can’t it be trusted to keep the transponders in the correct setting?

Autopilots can be turned off, because a malfunctioning autopilot may cause a crash. A malfunctioning transponder might broadcast flawed data, which is a concern. But a switched-off transponder can spell doom.

Five of the last 10 major air disasters — the four 9/11 flights, and Flight 370 — began with the transponder’s being switched off. A few design changes can make that impossible.